XOOPS Profile Activation Security Bypass Vulnerability

Bugtraq ID:	37028
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 16 2009 12:00AM
Updated:	Nov 16 2009 05:56PM
Credit:	XOOPS
Vulnerable:	Xoops Xoops 2.4 Xoops Xoops 2.3.3 Xoops Xoops 2.3.2 b Xoops Xoops 2.3.2 Xoops Xoops 2.2.5 Xoops Xoops 2.2.3 RC1 Xoops Xoops 2.2.3 Xoops Xoops 2.2.1 Xoops Xoops 2.0.18 .1 Xoops Xoops 2.0.18 Xoops Xoops 2.0.17 1 Xoops Xoops 2.0.15 Xoops Xoops 2.0.14 Xoops Xoops 2.0.13 .2 Xoops Xoops 2.0.13 .1 Xoops Xoops 2.0.12 a Xoops Xoops 2.0.12 Xoops Xoops 2.0.11 Xoops Xoops 2.0.10 Xoops Xoops 2.0.9 .3 Xoops Xoops 2.0.9 .2 Xoops Xoops 2.0.5 .2 Xoops Xoops 2.0.5 .1 Xoops Xoops 2.0.5 Xoops Xoops 2.0.3 Xoops Xoops 2.0.2 Xoops Xoops 2.0.1 Xoops Xoops 2.0 Xoops Xoops 2.3 Xoops Xoops 2.0.16 core
Not Vulnerable:	Xoops Xoops 2.4.1

XOOPS Profile Activation Security Bypass Vulnerability

XOOPS is prone to a security-bypass vulnerability that stems from a design error.

An attacker can exploit this vulnerability to bypass certain security restrictions and activate a new user without the administrator's approval.

The issue affects versions prior to XOOPS 2.4.1.

XOOPS Profile Activation Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

XOOPS Profile Activation Security Bypass Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

XOOPS Profile Activation Security Bypass Vulnerability

References:

• Profiles Module Activation Vulnerability (XOOPS)
  
• XOOPS 2.4.1 FINAL Is Released (XOOPS)
  
• XOOPS Homepage (XOOPS)